[MSITE-829] Upgrade Jetty to 9.4.x implicit java8 requirement now #21

olamy · 2020-05-14T12:00:10Z

No description provided.

pom.xml

Jenkinsfile

elharo · 2020-05-14T13:13:42Z

pom.xml

@@ -196,11 +196,11 @@ under the License.

  <properties>
    <mavenVersion>3.0</mavenVersion>
-    <javaVersion>7</javaVersion>
+    <javaVersion>8</javaVersion>


This change should probably be made, if at all, in its own PR, not as a driveby of a minor version dependency update

we need 8 for the change so let's do it all together
except having a sort of bureaucratic own PR I cannot see the technical need :)

@olamy I am the bureaucratic person. This needs to be changelog visible.

it's ALREADY there https://issues.apache.org/jira/browse/MSITE-828 and the git comment will clearly says that

Good, let's re-merge MSITE-828 first.

pom.xml

michael-o · 2020-05-19T20:37:32Z

pom.xml

@@ -623,6 +624,7 @@ under the License.
                <maven.compiler.source>${maven.compiler.source}</maven.compiler.source>
                <maven.compiler.target>${maven.compiler.target}</maven.compiler.target>
              </properties>
+              <javaHome>${java.home}</javaHome>


Why is that necessary?

michael-o · 2020-05-19T20:37:53Z

src/it/projects/new-configuration/pom.xml

@@ -76,7 +76,7 @@ under the License.
            <plugin>
              <groupId>org.apache.maven.plugins</groupId>
              <artifactId>maven-javadoc-plugin</artifactId>
-              <version>2.7</version>
+              <version>@javadocPluginVersion@</version>


How are these related?

I use java11 so the IT tests were failing for locally because of this and need more recent java version

Makes sense, but should be a separate PR because it is logically not related.

sorry but I will not do it. Maybe I should create a Jira ticket as well.
Seriously stop such nit picking... I prefer spend my time on more useful stuff for the project than waste my time remove this commit creating a branch and a separate PR only for this...
I don't see why it's useful for the project.

+1 on the JIRA ticket. If you are not willing to clean up. Leave as-is and have someone else clean it up. No issue.

LOL thanks you made my day

yeikel · 2021-08-27T16:58:27Z

Hi, what's blocking this? 9.2.29 is not safe anymore

michael-o · 2021-08-27T20:14:53Z

Hi, what's blocking this? 9.2.29 is not safe anymore

Not safe for what?

yeikel · 2021-08-28T19:52:20Z

Hi, what's blocking this? 9.2.29 is not safe anymore

Not safe for what?

Sorry, my initial comment was vague.

There are a couple of security vulnerabilities against Jetty, such as :

CVE-2021-28165
CVE-2021-28164
CVE-2021-28163

Read more : https://www.cybersecurity-help.cz/vdb/SB2021040179
https://www.eclipse.org/jetty/security_reports.php

michael-o · 2021-08-28T19:59:17Z

Hi, what's blocking this? 9.2.29 is not safe anymore

Not safe for what?

Sorry, my initial comment was vague.

There are a couple of security vulnerabilities against Jetty, such as :

CVE-2021-28165
CVE-2021-28164
CVE-2021-28163

Read more : https://www.cybersecurity-help.cz/vdb/SB2021040179
https://www.eclipse.org/jetty/security_reports.php

and none of them affect this plugin if you'd knew what we do with Jetty.

yeikel · 2021-09-01T15:09:42Z

Hi, what's blocking this? 9.2.29 is not safe anymore

Not safe for what?

Sorry, my initial comment was vague.

There are a couple of security vulnerabilities against Jetty, such as :

CVE-2021-28165
CVE-2021-28164
CVE-2021-28163

Read more : https://www.cybersecurity-help.cz/vdb/SB2021040179
https://www.eclipse.org/jetty/security_reports.php

and none of them affect this plugin if you'd knew what we do with Jetty.

That makes sense. Problem is that security scans do not have the background about how this is used within the plugin and they simply block the build when the plugin tries to pull Jetty

michael-o · 2021-09-01T15:31:00Z

Hi, what's blocking this? 9.2.29 is not safe anymore

Not safe for what?

Sorry, my initial comment was vague.
There are a couple of security vulnerabilities against Jetty, such as :
CVE-2021-28165
CVE-2021-28164
CVE-2021-28163
Read more : https://www.cybersecurity-help.cz/vdb/SB2021040179
https://www.eclipse.org/jetty/security_reports.php

and none of them affect this plugin if you'd knew what we do with Jetty.

That makes sense. Problem is that security scans do not have the background about how this is used within the plugin and they simply block the build when the plugin tries to pull Jetty

Therefore, I consider them partially useless. Just like this.

Maybe someone can rework the PR.

yeikel · 2021-09-01T17:21:01Z

Somewhat. They block Jetty for everyone(including the projects where the vulnerabilities applies) which affects this plugin indirectly.

If it helps, what we use is similar to this :
https://www.google.com/amp/s/blog.sonatype.com/keeping-third-party-dependencies-in-check-with-nexus%3fhs_amp=true

If this PR is considered stale then I can resume and maybe target the latest version instead?

michael-o · 2021-09-01T17:44:54Z

Somewhat. They block Jetty for everyone(including the projects where the vulnerabilities applies) which affects this plugin indirectly.

If it helps, what we use is similar to this :
https://www.google.com/amp/s/blog.sonatype.com/keeping-third-party-dependencies-in-check-with-nexus%3fhs_amp=true

Many vendors provide this superficial crap -- as you can see it proves nothing here.

If this PR is considered stale then I can resume and maybe target the latest version instead?

Split between Java 8 upgrade and Jetty upgrade in at least two PRs.

@hboutemy @rfscholte Yet another reason why we need to split this plugin in two.

olamy · 2021-09-02T00:27:45Z

Somewhat. They block Jetty for everyone(including the projects where the vulnerabilities applies) which affects this plugin indirectly.
If it helps, what we use is similar to this :
https://www.google.com/amp/s/blog.sonatype.com/keeping-third-party-dependencies-in-check-with-nexus%3fhs_amp=true

Many vendors provide this superficial crap -- as you can see it proves nothing here.

@michael-o
so many tools send warning/alarms because of dependencies with security issues/CVE.
maybe (certainly) it's wrong but big companies use those tools as a policy and we can't fight this!!
BUT we still want people using Apache Maven so we have to live with that!

@yeikel
I will update this PR

If this PR is considered stale then I can resume and maybe target the latest version instead?

Split between Java 8 upgrade and Jetty upgrade in at least two PRs.

@hboutemy @rfscholte Yet another reason why we need to split this plugin in two.

yeikel · 2021-09-02T00:31:36Z

Somewhat. They block Jetty for everyone(including the projects where the vulnerabilities applies) which affects this plugin indirectly.
If it helps, what we use is similar to this :
https://www.google.com/amp/s/blog.sonatype.com/keeping-third-party-dependencies-in-check-with-nexus%3fhs_amp=true

Many vendors provide this superficial crap -- as you can see it proves nothing here.

@michael-o
so many tools send warning/alarms because of dependencies with security issues/CVE.
maybe (certainly) it's wrong but big companies use those tools as a policy and we can't fight this!!
BUT we still want people using Apache Maven so we have to live with that!

@yeikel
I will update this PR

If this PR is considered stale then I can resume and maybe target the latest version instead?

Split between Java 8 upgrade and Jetty upgrade in at least two PRs.

@hboutemy @rfscholte Yet another reason why we need to split this plugin in two.

Definitely. We had to overwrite the version manually in our build to be able to use the plugin but doing so without the corresponding tests could introduce unexpected regressions for us

michael-o · 2021-09-02T05:33:21Z

Somewhat. They block Jetty for everyone(including the projects where the vulnerabilities applies) which affects this plugin indirectly.
If it helps, what we use is similar to this :
https://www.google.com/amp/s/blog.sonatype.com/keeping-third-party-dependencies-in-check-with-nexus%3fhs_amp=true

Many vendors provide this superficial crap -- as you can see it proves nothing here.

@michael-o
so many tools send warning/alarms because of dependencies with security issues/CVE.
maybe (certainly) it's wrong but big companies use those tools as a policy and we can't fight this!!
BUT we still want people using Apache Maven so we have to live with that!

I know and that is sadly stupid.

slachiewicz · 2021-09-02T08:27:03Z

Total 5 (delta 2), reused 0 (delta 0), pack-reused 0 remote: remote: remote: remote: GitHub found 18 vulnerabilities on apache/maven-site-plugin's default branch (15 high, 2 moderate, 1 low). To find out more, visit: remote: remote: https://github.com/apache/maven-site-plugin/security/dependabot remote: remote:

slachiewicz · 2021-09-02T08:50:17Z

@olamy builds fails only on Maven 3.8.2, same on the master branch

olamy · 2021-09-02T08:52:15Z

@slachiewicz I saw and I guess because of https://issues.apache.org/jira/browse/MNG-7215

slawekjaranowski · 2021-09-02T09:12:38Z

@olamy builds fails only on Maven 3.8.2, same on the master branch

All GitHub runners will have Maven 3.8.2 in a moment
actions/runner-images#3969

yeikel · 2021-12-02T15:23:28Z

Sorry to bump, but what happened to this?

olamy · 2021-12-03T02:50:54Z

I rebased from master.
will wait few days and if no complain I will merge that.

yeikel · 2022-02-22T14:54:07Z

I rebased from master. will wait few days and if no complain I will merge that.

Did you get a chance to work on this?

- build from 8 only and we do not support anymore 3.0.x - improve gh action Signed-off-by: Olivier Lamy <olamy@apache.org>

Signed-off-by: Olivier Lamy <olamy@apache.org>

mthmulders reviewed May 14, 2020

View reviewed changes

pom.xml Outdated Show resolved Hide resolved

elharo reviewed May 14, 2020

View reviewed changes

olamy marked this pull request as ready for review May 16, 2020 01:43

olamy changed the title ~~[MSITE-829] Upgrade Jetty to 9.4.x~~ [MSITE-829] Upgrade Jetty to 9.4.x implicit java8 requirement now May 18, 2020

michael-o requested changes May 19, 2020

View reviewed changes

slachiewicz approved these changes May 19, 2020

View reviewed changes

khmarbaise approved these changes May 20, 2020

View reviewed changes

olamy force-pushed the MSITE-829 branch 2 times, most recently from 249b4a8 to 64d4100 Compare June 8, 2020 00:35

olamy force-pushed the MSITE-829 branch 2 times, most recently from 625ee31 to 88aa108 Compare September 2, 2021 00:55

olamy requested review from rfscholte, mthmulders and michael-o September 2, 2021 00:56

olamy force-pushed the MSITE-829 branch from 88aa108 to 4383136 Compare December 3, 2021 02:13

olamy closed this Dec 3, 2021

olamy reopened this Dec 3, 2021

olamy added 2 commits February 23, 2022 13:36

[MSITE-829] use jetty 9.4.43.v20210629

18fc90d

- build from 8 only and we do not support anymore 3.0.x - improve gh action Signed-off-by: Olivier Lamy <olamy@apache.org>

use last jetty 9.4.44

27d26cd

Signed-off-by: Olivier Lamy <olamy@apache.org>

olamy force-pushed the MSITE-829 branch from 4383136 to 27d26cd Compare February 23, 2022 03:37

olamy mentioned this pull request Feb 23, 2022

Upgrade to maven 3.2.5 + Java8 #73

Merged

olamy merged commit 0b1c775 into master Feb 23, 2022

olamy deleted the MSITE-829 branch February 23, 2022 06:40

olamy added the enhancement label Feb 23, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[MSITE-829] Upgrade Jetty to 9.4.x implicit java8 requirement now #21

[MSITE-829] Upgrade Jetty to 9.4.x implicit java8 requirement now #21

olamy commented May 14, 2020

elharo May 14, 2020

olamy May 15, 2020

michael-o May 19, 2020

olamy May 19, 2020

michael-o May 19, 2020

michael-o May 19, 2020

michael-o May 19, 2020

olamy May 19, 2020 •

edited

Loading

michael-o May 19, 2020

olamy May 19, 2020

michael-o May 19, 2020

olamy May 19, 2020

yeikel commented Aug 27, 2021

michael-o commented Aug 27, 2021

yeikel commented Aug 28, 2021

michael-o commented Aug 28, 2021

yeikel commented Sep 1, 2021 •

edited

Loading

michael-o commented Sep 1, 2021

yeikel commented Sep 1, 2021

michael-o commented Sep 1, 2021

olamy commented Sep 2, 2021

yeikel commented Sep 2, 2021

michael-o commented Sep 2, 2021

slachiewicz commented Sep 2, 2021

slachiewicz commented Sep 2, 2021

olamy commented Sep 2, 2021

slawekjaranowski commented Sep 2, 2021

yeikel commented Dec 2, 2021

olamy commented Dec 3, 2021

yeikel commented Feb 22, 2022

[MSITE-829] Upgrade Jetty to 9.4.x implicit java8 requirement now #21

[MSITE-829] Upgrade Jetty to 9.4.x implicit java8 requirement now #21

Conversation

olamy commented May 14, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

olamy May 19, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yeikel commented Aug 27, 2021

michael-o commented Aug 27, 2021

yeikel commented Aug 28, 2021

michael-o commented Aug 28, 2021

yeikel commented Sep 1, 2021 • edited Loading

michael-o commented Sep 1, 2021

yeikel commented Sep 1, 2021

michael-o commented Sep 1, 2021

olamy commented Sep 2, 2021

yeikel commented Sep 2, 2021

michael-o commented Sep 2, 2021

slachiewicz commented Sep 2, 2021

slachiewicz commented Sep 2, 2021

olamy commented Sep 2, 2021

slawekjaranowski commented Sep 2, 2021

yeikel commented Dec 2, 2021

olamy commented Dec 3, 2021

yeikel commented Feb 22, 2022

olamy May 19, 2020 •

edited

Loading

yeikel commented Sep 1, 2021 •

edited

Loading